APD/GBA (Belgium) - 10/2023

From GDPRhub
Revision as of 13:22, 21 February 2023 by FeestHoed (talk | contribs)
APD/GBA - 10/2023
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 12(3) GDPR
Article 12(4) GDPR
Article 15 GDPR
Article 15(1) GDPR
Article 15(1)(c) GDPR
Type: Complaint
Outcome: Other Outcome
Started: 28.11.2022
Decided: 13.02.2023
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: 10/2023
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): French
Original Source: Gegevenbeschermingsautoriteit (in FR)
Initial Contributor: Enzo Marquet

The Belgian DPA ordered two controllers to comply with an access request pursuant to Article 58(2)(c) GDPR.

English Summary

Facts

The data subject had taken out loans at the two concerned controllers. On 8 June 2022, the data subject requested access to her personal data on the basis of Article 15 GDPR and requested information on the possible sharing of her personal data with collection companies. Both controllers did not respond to the access request.

Holding

The DPA established that Article 15(1) GDPR grants all data subject a right of access to their personal data and the right to know the recipients or categories of recipients is included through Article 15(1)(c) GDPR. This right is the cornerstone which allows data subject to verify the lawfulness of each processing activity and to rectify or erase their personal data.

The DPA held that the controllers could have breached Article 12(3) GDPR by not responding within one month, without notification and justification of the extension of this time limit as set out by Article 12(4) GDPR.

The DPA ordered the controller to comply with the access request pursuant of Article 58(2)(c) GDPR and and Article 95(1)(5) LCA (Law establishing the data protection authority).

Comment

This was a preliminary (Prima Facie) decision according to Article 95 WOG, prior to a decision on the merits.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/5





                                                                           Litigation Chamber


                                                          Decision 10/2023 of February 13, 2023





File number: DOS-2022-05270


Subject: Lack of response to the exercise of the right of access




The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“ACL”;

Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;





Made the following decision regarding:


                                                                                                           .
The complainant: X, hereinafter “the complainant”;
                                                                                                           .

Defendant: Y1, hereinafter: “Defendant 1”; .



                     Y2, hereinafter: “Defendant 2”; Decision 10/2023 – 2/5



I. Facts and procedure


 1. The subject matter of the Complaint relates to the lack of response from Defendant 1 and the

       Respondent 2 to Complainant's request for access.

       The plaintiff contracted loans with defendant 1 and defendant 2.

       On June 8, 2022, the complainant requested access to her personal data from

       of the defendants on the basis of Article 15 of the GDPR. The complainant also indicated

       want information on possible transfers of their personal data to

       collection companies.


 2. On November 28, 2022, the complainant lodged a complaint with the Protection Authority

       data against defendants 1 and 2.

 3. On January 24, 2023, the complaint was declared admissible by the Front Line Service on the

       basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber

       pursuant to Article 62, § 1 of the LCA.


 4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order

       inside the DPA, a copy of the file may be requested by the parties. If one of

       parties wishes to make use of the possibility of consulting the file, the latter is required to
       contact the secretariat of the Litigation Chamber, preferably via the address

       litigationchamber@apd-gba.be.






II. Motivation


 5. Article 15.1 of the GDPR allows any data subject to access the data

       kept by the data controller about it. This right also includes

       know “the recipients or categories of recipients to whom the data to be

       personal nature have been or will be communicated […]” (art. 15.1.c of the GDPR).

 6. Under Article 12.3 of the GDPR, the controller has a maximum period

       one month from receipt of the access request to provide a response. This

       this period may, subject to conditions, be extended by an additional month (Art. 12.4 of the GDPR).


 7. The Litigation Chamber emphasizes the importance of respecting the right of access of persons

       concerned. This right allows data subjects to control the legality of each




1
 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 10/2023 – 3/5



       processing activity and, where appropriate, to have the personal data rectified or erased

       staff processed.

 8. It appears from the documents in the file that Defendant 1 and Defendant 2 did not

       responded to this request within the time limit of one month (art. 12.3 of the GDPR), without

       notification and motivation of the extension of this period (art. 12.4 of the GDPR).


 9. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to

       conclude that defendants 1 and 2 may have committed a violation of the provisions
       of the GDPR, which justifies, in this case, taking a decision in accordance

       to Article 95, § 1, 5° of the LCA, more specifically, to comply with the request of the

       complainant to exercise his right of access (Article 15.1 of the GDPR).


       This decision is based on the fact that the complainant transmitted to the Chamber the content of her

       request to the defendants, without however providing proof of sending.

 10. This decision is a prima facie decision taken by the Litigation Chamber

       pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the

       complainant, in the context of the "procedure prior to the substantive decision" and not a

       decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.


 11. The purpose of this decision is to inform the defendants, allegedly responsible for the

       treatment, because they may have committed a violation of the provisions of the

       GDPR, in order to enable them to still comply with the aforementioned provisions.

 12. If, however, one of the defendants does not agree with the content of this

       prima facie decision and believes that it can make arguments of fact and/or

       legal issues which could lead to another decision, it may address to the Chamber

       Litigation a request for processing on the merits of the case via the e-mail address

       litigationchamber@apd-gba.be, within 30 days of notification of the

       this decision. If necessary, the execution of this decision is suspended.

       during the aforementioned period.


 13. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

       juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their

       conclusions and attach to the file all the documents they deem useful. If applicable, the
       this decision is permanently suspended.


 14. With a view to transparency, the Litigation Division finally emphasizes that a

       dealing with the case on the merits may lead to the imposition of the measures mentioned in

       section 100 of the ACL.



3
 Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive).
4Art. 100. § 1. The litigation chamber has the power of Decision 10/2023 – 4/5



III. Publication of the decision


 15. Given the importance of transparency regarding the decision-making process of the Chamber

        Litigation, this decision is published on the website of the Protection Authority

        Datas. However, it is not necessary for this purpose that the identification data

        of the parties are communicated directly.










    FOR THESE REASONS,


    The Litigation Chamber of the Data Protection Authority decides, subject to

    the introduction of a request by Defendant 1 or Defendant 2 for treatment

    on the merits in accordance with articles 98 e.s. of the ACL:


        - Pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order

            Defendant 1 and Defendant 2 to comply with the request of the

            data subject to exercise their rights, more specifically the right of access (Article

            15.1 of the GDPR), and this within 30 days from the date of notification of this

            decision ;

        - To order Defendant 1 and Defendant 2 to inform the Authority by e-mail

            of data protection (Litigation Chamber) of the follow-up given to this

            decision, within the same period, via the e-mail address litigationchamber@apd-gba.be; And


        - If one of the defendants does not comply in due time with what is requested

            above, the latter will automatically have their file examined on the merits, in accordance with the

            articles 98 e.s. of the ACL.






 1° dismiss the complaint without follow-up;
 2° order the dismissal;
 3° pronouncing the suspension of the pronouncement;
 4° to propose a transaction;
 5° issue warnings and reprimands;
 6° order to comply with requests from the data subject to exercise his or her rights;
 7° order that the person concerned be informed of the security problem;

 8° order the freezing, limitation or temporary or permanent prohibition of processing;
 9° order compliance of the processing;
 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
     data ;
 11° order the withdrawal of accreditation from certification bodies;
 12° to issue periodic penalty payments;
 13° to issue administrative fines;
 14° order the suspension of cross-border data flows to another State or an international body;
 15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 10/2023 – 5/5





In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

                                                                             5
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
                                                                                                                    6
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).









    (Sr.) Hielke H IJMANS

    President of the Litigation Chamber










































5The request contains on pain of nullity:
  (1) indication of the day, month and year;

  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
  (4) the object and summary statement of the means of the request;
  (5) the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer.

6 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.